last executing test programs:

2.456384809s ago: executing program 1 (id=310):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000780)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x24}, @remote, 0x9, 0x0, 0x1, 0x100, 0x4, 0x2930310})

2.369139516s ago: executing program 1 (id=313):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r1, 0x1, 0x0, 0x0, {{}, {}, {0x3, 0x14, 'syz0\x00'}}}, 0x28}}, 0x0)

2.318233559s ago: executing program 2 (id=315):
r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
connect$llc(r0, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x4, 0x0, 0x0, @broadcast}, 0x10)
recvmmsg(r0, &(0x7f00000050c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0)
sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0)

2.259407225s ago: executing program 1 (id=316):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x4}}]}, 0x38}}, 0x0)

2.210402798s ago: executing program 1 (id=318):
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000005c0)=ANY=[@ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="0200000002"], 0x10)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)={@cgroup=r2, r3, 0x2, 0x2}, 0x10)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="180000000000000000000000000000009500160000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94)
r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r4}, 0x10)
r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r5}, 0x8)
close(r6)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005345c0f63cdc2e82818254950ee03568b8809a1f04c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab66c1aae9314d7381fcfeb970bea672010000000000000043144648a07a975bd89dc398712376610faa54f12495b4659be8673086f6f3543205d4bc4ce05b8b961103673dff7f158052e62bfbdcddde6985f3f1ac5d9a94cc53207899762a07282a1914452d11858e795a3ca30a101af5574f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5ed44039aab46419496362e54cfad05b4004ac71a003d7b85d07191bed4e5a8908263722d4146f7ed569985439baa355cf3d8731f5e7a237bc06d035a8d601f21746d880819f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c5b9f87d988c9fbd2b9d9b4e2d71753b1549fa734f0b2e5fcf9549804cddad721971637f9c9730a9cc384eed30345979db9c93e1c52f42cad0a4d4f9436d3f39b0ed09c395dc6e970366087a8e4daeeb1b017006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f710c490ecd085d2811a7555c53030000007f00000000bfa6478eb96b079c277e2910b7ccdc3d672ed34aa65278c549e2abb549ad954884289130bc71cee2b7de62bf48129ae1af052a2d46a6165eb0954dac7265f1f425735acf6377793946b3229e861d8ea49806b3b533345d36ecef9df700000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c000000aaae37f044bcadeb0f6846582b7653665aa336db9f0384d3c7ddf79c2e0000000000000000000000000000000000000000000000e154aa0d3e41986a668ee1e5ef93a8ceac75f44aae95e26742f895f287111f8ee86f7e3ffb63cfb0e345cf7fc63dd2b0d30977899c6f03640040af4db71f7452bfc79a05118d8bb42b63b195771e42f9942ec626bd4b5461b74324012164e8"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70)
r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000240)={@cgroup=r8, r7, 0x2, 0x6, 0x4000}, 0x10)

2.140718773s ago: executing program 1 (id=320):
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f00000002c0)=ANY=[@ANYBLOB="05000000000000006911a100000000008510000002000000850800008b00000095000000000000009500a50500000000699b43160164f7d8c18db44ce3cf122c2d74e3c1b081c16865a27cd49574c26244542623f02a5e19f2aba86f807a3b25c228c3cae180920fc8dba13064e95243659a6a2355e361a2d17b47c4f7044cc168d2a93340ecbce95e922dcf4259932d2d25198c032df2700688ffbbf0d97ccecea92abf074d8dd932426e7dd470472a9b80bfa515d611ef8e7b18b5bcfc5f7b3bcf89bd8b88c9351c1ab6f92bf13a5bc2c7d1fd1c1b148404f8d416483603c238ef00"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70)

1.830436024s ago: executing program 1 (id=327):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000180)=@filter={'filter\x00', 0xe, 0x0, 0xc0, [0x6000000, 0x2000000000c0, 0x2000000000f0, 0x200000000120], 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff000000003d9cd4ae000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000"]}, 0x138)

1.388361186s ago: executing program 2 (id=333):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0x3, &(0x7f00000003c0)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36)

1.289630018s ago: executing program 2 (id=335):
pipe(&(0x7f00000001c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
close(r0)
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000080)=0x10)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000140)={0x1, [<r2=>0x0]}, &(0x7f0000000240)=0x8)
getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000000c0)={r2, 0x5}, &(0x7f0000000180)=0x8)

610.822417ms ago: executing program 0 (id=341):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r0, <r1=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000c00000085000000a500000095"], &(0x7f0000000240)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0xc}, 0x94)

493.78825ms ago: executing program 0 (id=342):
syz_emit_ethernet(0x46, &(0x7f0000000180)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x8, 0x38, 0x0, 0x0, 0x0, 0x5, 0x0, @initdev={0xac, 0x1e, 0x2, 0x0}, @private=0xa010100, {[@lsrr={0x83, 0x7, 0x22, [@multicast1]}, @lsrr={0x83, 0x7, 0xcb, [@broadcast]}, @generic={0x83, 0x2}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0)

392.830692ms ago: executing program 0 (id=343):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000009c0)=ANY=[@ANYBLOB="3c00000010000304000000000000000100000300", @ANYRES32=r0, @ANYBLOB="0000000000000000140012800a000100767863616e0000006200028008004040b64eb6"], 0x3c}}, 0x0)

392.32704ms ago: executing program 2 (id=344):
sendmsg$NL80211_CMD_DEL_STATION(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000380)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf670000000000001507"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
close(r0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6)
ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180))

340.544618ms ago: executing program 0 (id=345):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x3, 0x0, &(0x7f0000000000))

240.587333ms ago: executing program 0 (id=346):
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, 0x0}, 0x4)
setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, 0x0, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, 0x0, 0x0)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[], 0x60}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, 0x0, 0x400c844)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
openat$tun(0xffffffffffffff9c, 0x0, 0x42000, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r4 = socket$kcm(0x2, 0x3, 0x2)
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast})
write$tun(r3, &(0x7f0000002280)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x2, 0x1000, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x2, 0x16, 0x66, 0x0, 0x8b, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, "3297"}}, 0x24)

149.258228ms ago: executing program 2 (id=347):
r0 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'team_slave_0\x00', &(0x7f0000000040)=@ethtool_stats={0x37}})

70.108307ms ago: executing program 2 (id=348):
r0 = socket$kcm(0x2d, 0x2, 0x0)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000001c0)=<r2=>0x0)
unshare(0x2a020480)
r3 = socket(0xa, 0x3, 0x3a)
connect$vsock_stream(r3, &(0x7f0000000140)={0x28, 0x0, 0x2711, @hyper}, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$ETHTOOL_MSG_FEATURES_SET(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYRES16, @ANYRES16, @ANYRESDEC], 0x38}}, 0x0)
write$cgroup_pid(r0, &(0x7f0000000280)=r2, 0x12)
r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000003c0), r1)
sendmsg$NLBL_CIPSOV4_C_LISTALL(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000b80)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="fba70000e80000867f0004"], 0x14}}, 0x0)
r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8}, 0x48)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
socket$inet6_udplite(0xa, 0x2, 0x88)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00'}, 0x10)
ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r8 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local})
writev(r7, &(0x7f00000002c0)=[{&(0x7f0000002280)="2e9b3d0007e03dd65193dfb6c575963f86ddf06712e9232f328db0049d90491ceaebfd26d4eef23248000000f858dbb8a19052", 0x33}, {&(0x7f0000000040)="8ece37b4e2d66e5245eb5b9b5d371c", 0xf}], 0x2)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r6}, 0x8)
bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffd}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x9, 0x3, 0x2d8, 0x110, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, [0x0, 0xff, 0xffffffff, 0xff000000], [0xffffff00, 0xff, 0xffffff00, 0xffffff00], 'virt_wifi0\x00', 'veth0_to_batadv\x00', {}, {}, 0x62, 0x3, 0x3, 0x30}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x4, 0x40, 0x8, 0x530, 'syz1\x00', 'syz1\x00', {0x2}}}}, {{@ipv6={@mcast1, @loopback, [0xffffffff, 0x0, 0xffffffff, 0xff], [0x0, 0x0, 0xff, 0xff000000], 'syz_tun\x00', 'dvmrp0\x00', {}, {}, 0x0, 0x7, 0xa, 0x5e}, 0x0, 0xd8, 0xf8, 0x0, {}, [@common=@srh={{0x30}, {0x2e, 0xc, 0x8, 0x4, 0xe, 0x1000, 0xc1}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338)
r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff)
sendmsg$NL802154_CMD_GET_SEC_LEVEL(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x14, r10, 0x701, 0x70bd2b, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20004074}, 0x0)
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00'})

0s ago: executing program 0 (id=349):
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'wlan1\x00', @random="20ffeb910608"})
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'syz_tun\x00'})
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f00000018c0)={0x0, 0x0, 0x0}, 0xc911)
r5 = socket$igmp(0x2, 0x3, 0x2)
ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000a80)={{0x2, 0x4e22, @empty}, {0x0, @remote}, 0x48, {0x2, 0x0, @empty}, 'lo\x00'})
ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f0000000100)={{0x2, 0x4e22, @empty}, {0x0, @multicast}, 0xa, {0x2, 0x0, @initdev={0xac, 0x1e, 0xff, 0x0}}, 'veth0_to_batadv\x00'})

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:21338' (ED25519) to the list of known hosts.
syzkaller login: [   56.281667][ T5818] cgroup: Unknown subsys name 'net'
[   56.386903][ T5818] cgroup: Unknown subsys name 'cpuset'
[   56.393328][ T5818] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.253174][ T5818] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   63.289153][ T5834] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   63.305341][   T55] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   63.312001][   T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   63.322297][   T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   63.325782][   T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   63.331667][   T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   63.337261][   T55] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   63.340780][   T55] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   63.344556][ T5845] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   63.349080][ T5845] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   63.352152][ T5845] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   63.353363][ T5839] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   63.357424][ T5839] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   63.362684][ T5839] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   63.365176][ T5839] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   63.649500][ T5841] chnl_net:caif_netlink_parms(): no params data found
[   63.750415][ T5832] chnl_net:caif_netlink_parms(): no params data found
[   63.806452][ T5836] chnl_net:caif_netlink_parms(): no params data found
[   63.902892][ T5841] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.905466][ T5841] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.908608][ T5841] bridge_slave_0: entered allmulticast mode
[   63.914135][ T5841] bridge_slave_0: entered promiscuous mode
[   63.950257][ T5841] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.952763][ T5841] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.955114][ T5841] bridge_slave_1: entered allmulticast mode
[   63.958535][ T5841] bridge_slave_1: entered promiscuous mode
[   64.035886][ T5832] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.038326][ T5832] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.040828][ T5832] bridge_slave_0: entered allmulticast mode
[   64.044385][ T5832] bridge_slave_0: entered promiscuous mode
[   64.050229][ T5841] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.055027][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.057649][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.060024][ T5836] bridge_slave_0: entered allmulticast mode
[   64.064044][ T5836] bridge_slave_0: entered promiscuous mode
[   64.066998][ T5832] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.069549][ T5832] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.073678][ T5832] bridge_slave_1: entered allmulticast mode
[   64.077561][ T5832] bridge_slave_1: entered promiscuous mode
[   64.082457][ T5841] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.085673][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.087864][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.090120][ T5836] bridge_slave_1: entered allmulticast mode
[   64.094006][ T5836] bridge_slave_1: entered promiscuous mode
[   64.168504][ T5832] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.174930][ T5841] team0: Port device team_slave_0 added
[   64.178664][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.184936][ T5832] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.189574][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.195910][ T5841] team0: Port device team_slave_1 added
[   64.247292][ T5832] team0: Port device team_slave_0 added
[   64.251310][ T5836] team0: Port device team_slave_0 added
[   64.266516][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.268788][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.278169][ T5841] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.284246][ T5832] team0: Port device team_slave_1 added
[   64.287496][ T5836] team0: Port device team_slave_1 added
[   64.290502][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.293308][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.302110][ T5841] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.359475][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.363391][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.373574][ T5832] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.382891][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.385686][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.396468][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.402010][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.404934][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.415462][ T5832] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.421453][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.424814][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.435330][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.470237][ T5841] hsr_slave_0: entered promiscuous mode
[   64.472853][ T5841] hsr_slave_1: entered promiscuous mode
[   64.499822][ T5832] hsr_slave_0: entered promiscuous mode
[   64.502909][ T5832] hsr_slave_1: entered promiscuous mode
[   64.505399][ T5832] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   64.508281][ T5832] Cannot create hsr debugfs directory
[   64.592720][ T5836] hsr_slave_0: entered promiscuous mode
[   64.595875][ T5836] hsr_slave_1: entered promiscuous mode
[   64.599470][ T5836] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   64.604577][ T5836] Cannot create hsr debugfs directory
[   64.964302][ T5841] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   64.984624][ T5841] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   64.992719][ T5841] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   65.009907][ T5841] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   65.067565][ T5836] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   65.077843][ T5836] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   65.100383][ T5836] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   65.109476][ T5836] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   65.197206][ T5832] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   65.214753][ T5832] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   65.227248][ T5832] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   65.237271][ T5832] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   65.344507][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.351427][ T5841] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.378520][ T5836] 8021q: adding VLAN 0 to HW filter on device team0
[   65.388315][ T5841] 8021q: adding VLAN 0 to HW filter on device team0
[   65.400005][   T65] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.402536][   T65] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.410214][   T65] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.412477][   T65] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.416654][   T65] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.419909][   T65] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.432927][ T5845] Bluetooth: hci1: command tx timeout
[   65.433039][ T5834] Bluetooth: hci2: command tx timeout
[   65.434978][ T5845] Bluetooth: hci0: command tx timeout
[   65.443814][   T65] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.446348][   T65] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.491478][ T5832] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.543172][ T5832] 8021q: adding VLAN 0 to HW filter on device team0
[   65.558081][   T65] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.561094][   T65] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.586383][   T65] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.589454][   T65] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.797765][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.875397][ T5841] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.899511][ T5836] veth0_vlan: entered promiscuous mode
[   65.915579][ T5836] veth1_vlan: entered promiscuous mode
[   65.946240][ T5841] veth0_vlan: entered promiscuous mode
[   65.968420][ T5841] veth1_vlan: entered promiscuous mode
[   65.975972][ T5832] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.998849][ T5836] veth0_macvtap: entered promiscuous mode
[   66.011515][ T5836] veth1_macvtap: entered promiscuous mode
[   66.028702][ T5841] veth0_macvtap: entered promiscuous mode
[   66.038808][ T5841] veth1_macvtap: entered promiscuous mode
[   66.061761][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.067706][ T5832] veth0_vlan: entered promiscuous mode
[   66.079845][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.087722][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.093322][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.100243][ T5832] veth1_vlan: entered promiscuous mode
[   66.109524][ T5836] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.114968][ T5836] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.118379][ T5836] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.121787][ T5836] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.134281][ T5841] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.137260][ T5841] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.140223][ T5841] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.144584][ T5841] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.236355][ T5832] veth0_macvtap: entered promiscuous mode
[   66.249954][ T5832] veth1_macvtap: entered promiscuous mode
[   66.295278][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.329057][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.333974][ T4677] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.337562][ T4677] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.342374][   T65] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.348603][   T65] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.375961][ T5832] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.379537][ T5832] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.386028][ T5832] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.390998][ T5832] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.423630][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.436567][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.461336][ T4677] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.485749][ T4677] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.498573][ T5841] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   66.615546][   T29] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.618805][   T29] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.704651][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.707815][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.711450][ T5906] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1'.
[   67.286140][ T5940] netlink: 'syz.2.17': attribute type 8 has an invalid length.
[   67.327238][ T5943] syz.0.19 uses obsolete (PF_INET,SOCK_PACKET)
[   67.513639][ T5845] Bluetooth: hci0: command tx timeout
[   67.522115][ T5845] Bluetooth: hci2: command tx timeout
[   67.522253][ T5839] Bluetooth: hci1: command tx timeout
[   67.773098][ T5950] netlink: 'syz.1.21': attribute type 13 has an invalid length.
[   67.779373][ T5950] netlink: 'syz.1.21': attribute type 17 has an invalid length.
[   67.846648][ T5950] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   68.106954][ T5958] openvswitch: netlink: IPv4 tun info is not correct
[   68.621503][ T5994] netlink: 12 bytes leftover after parsing attributes in process `syz.1.41'.
[   68.650243][ T5991] openvswitch: netlink: VXLAN extension 274 out of range max 1
[   68.680009][ T5997] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   68.681454][ T5999] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   68.717902][ T5991] bridge_slave_0: left allmulticast mode
[   68.740506][ T5991] bridge_slave_0: left promiscuous mode
[   68.748310][ T5991] bridge0: port 1(bridge_slave_0) entered disabled state
[   68.766059][ T5991] bridge_slave_1: left allmulticast mode
[   68.768160][ T5991] bridge_slave_1: left promiscuous mode
[   68.771111][ T5991] bridge0: port 2(bridge_slave_1) entered disabled state
[   68.778315][ T5991] bond0: (slave bond_slave_0): Releasing backup interface
[   68.788222][ T5991] bond0: (slave bond_slave_1): Releasing backup interface
[   68.789543][ T6005] netlink: 24 bytes leftover after parsing attributes in process `syz.1.43'.
[   68.814869][ T5991] team0: Port device team_slave_0 removed
[   68.825082][ T5991] team0: Port device team_slave_1 removed
[   68.828260][ T5991] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   68.831172][ T5991] batman_adv: batadv0: Removing interface: batadv_slave_0
[   68.847505][ T5991] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   68.850554][ T5991] batman_adv: batadv0: Removing interface: batadv_slave_1
[   69.002587][ T5991] syz.2.40 (5991) used greatest stack depth: 19928 bytes left
[   69.085966][ T6012] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check.
[   69.259994][ T5997] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   69.347424][ T5997] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   69.421281][ T5997] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   69.509189][ T5997] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   69.532329][ T5997] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   69.549244][ T5997] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   69.565536][ T5997] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   69.600336][ T5839] Bluetooth: hci1: command tx timeout
[   69.602554][ T5845] Bluetooth: hci2: command tx timeout
[   69.602596][ T5845] Bluetooth: hci0: command tx timeout
[   69.616274][ T6025] infiniband syz0: set down
[   69.618442][ T6025] infiniband syz0: added ipvlan1
[   69.638998][ T6028] netlink: 20 bytes leftover after parsing attributes in process `syz.0.52'.
[   69.678024][ T6025] RDS/IB: syz0: added
[   69.684777][ T6025] smc: adding ib device syz0 with port count 1
[   69.686975][ T6025] smc:    ib device syz0 port 1 has pnetid 
[   70.106775][ T6041] xt_policy: output policy not valid in PREROUTING and INPUT
[   70.348597][   T47] IPVS: starting estimator thread 0...
[   70.428692][ T6057] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   70.462077][ T6052] IPVS: using max 62 ests per chain, 148800 per kthread
[   71.000392][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[   71.005060][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[   71.160791][ T6090] netlink: 28 bytes leftover after parsing attributes in process `syz.2.76'.
[   71.164677][ T6090] netlink: 28 bytes leftover after parsing attributes in process `syz.2.76'.
[   71.167480][ T6090] netlink: 24 bytes leftover after parsing attributes in process `syz.2.76'.
[   71.479605][ T6102] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   71.572714][ T6104] netlink: 8 bytes leftover after parsing attributes in process `syz.2.83'.
[   71.672358][ T5834] Bluetooth: hci0: command tx timeout
[   71.675508][ T5834] Bluetooth: hci2: command tx timeout
[   71.677304][ T5834] Bluetooth: hci1: command tx timeout
[   71.818767][ T6117] netlink: 'syz.1.88': attribute type 21 has an invalid length.
[   71.824514][ T6117] netlink: 'syz.1.88': attribute type 22 has an invalid length.
[   71.827285][ T6117] netlink: 'syz.1.88': attribute type 23 has an invalid length.
[   71.830245][ T6117] netlink: 'syz.1.88': attribute type 25 has an invalid length.
[   71.853158][ T6117] netlink: 96 bytes leftover after parsing attributes in process `syz.1.88'.
[   72.033185][ T6128] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   72.036703][ T6128] IPv6: NLM_F_CREATE should be set when creating new route
[   72.087957][ T6123] netlink: 24 bytes leftover after parsing attributes in process `syz.0.91'.
[   72.099292][ T6123] lo: entered allmulticast mode
[   72.106498][ T6123] tunl0: entered allmulticast mode
[   72.110830][ T6123] gre0: entered allmulticast mode
[   72.136740][ T6123] gretap0: entered allmulticast mode
[   72.163649][ T6123] erspan0: entered allmulticast mode
[   72.177954][ T6123] ip_vti0: entered allmulticast mode
[   72.189724][ T6123] ip6_vti0: entered allmulticast mode
[   72.204284][ T6123] sit0: entered allmulticast mode
[   72.226377][ T6123] ip6tnl0: entered allmulticast mode
[   72.231256][ T6123] ip6gre0: entered allmulticast mode
[   72.239382][ T6123] syz_tun: entered allmulticast mode
[   72.244110][ T6136] netlink: 4 bytes leftover after parsing attributes in process `syz.1.96'.
[   72.248241][ T6123] ip6gretap0: entered allmulticast mode
[   72.255940][ T6123] bridge0: port 2(bridge_slave_1) entered disabled state
[   72.260254][ T6123] bridge0: port 1(bridge_slave_0) entered disabled state
[   72.266491][ T6123] bridge0: entered allmulticast mode
[   72.272695][ T6123] vcan0: entered allmulticast mode
[   72.277626][ T6123] bond0: entered allmulticast mode
[   72.279685][ T6123] bond_slave_0: entered allmulticast mode
[   72.282506][ T6123] bond_slave_1: entered allmulticast mode
[   72.291276][ T6123] team0: entered allmulticast mode
[   72.293922][ T6123] team_slave_0: entered allmulticast mode
[   72.296960][ T6123] team_slave_1: entered allmulticast mode
[   72.307150][ T6123] dummy0: entered allmulticast mode
[   72.318309][ T6123] nlmon0: entered allmulticast mode
[   72.322888][ T6123] caif0: entered allmulticast mode
[   72.325825][ T6123] batadv0: entered allmulticast mode
[   72.332283][ T6123] vxcan0: entered allmulticast mode
[   72.337460][ T6123] vxcan1: entered allmulticast mode
[   72.341220][ T6123] veth0: entered allmulticast mode
[   72.347876][ T6123] veth1: entered allmulticast mode
[   72.356442][ T6123] wg0: entered allmulticast mode
[   72.361465][ T6123] wg1: entered allmulticast mode
[   72.368303][ T6123] wg2: entered allmulticast mode
[   72.374888][ T6123] veth0_to_bridge: entered allmulticast mode
[   72.380402][ T6138] netlink: 'syz.1.96': attribute type 10 has an invalid length.
[   72.385495][ T6123] veth1_to_bridge: entered allmulticast mode
[   72.394590][ T6123] veth0_to_bond: entered allmulticast mode
[   72.405619][ T6123] veth1_to_bond: entered allmulticast mode
[   72.412580][ T6123] veth0_to_team: entered allmulticast mode
[   72.421448][ T6123] veth1_to_team: entered allmulticast mode
[   72.430105][ T6123] veth0_to_batadv: entered allmulticast mode
[   72.441141][ T6123] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   72.446161][ T6123] batadv_slave_0: entered allmulticast mode
[   72.452606][ T6123] veth1_to_batadv: entered allmulticast mode
[   72.458299][ T6123] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   72.462891][ T6123] batadv_slave_1: entered allmulticast mode
[   72.469795][ T6123] xfrm0: entered allmulticast mode
[   72.476465][ T6123] veth0_to_hsr: entered allmulticast mode
[   72.483142][ T6123] hsr_slave_0: entered allmulticast mode
[   72.488362][ T6123] veth1_to_hsr: entered allmulticast mode
[   72.494545][ T6123] hsr_slave_1: entered allmulticast mode
[   72.500264][ T6123] hsr0: entered allmulticast mode
[   72.506001][ T6123] veth1_virt_wifi: entered allmulticast mode
[   72.514076][ T6123] veth0_virt_wifi: entered allmulticast mode
[   72.523667][ T6123] net veth1_virt_wifi virt_wifi0: entered allmulticast mode
[   72.527316][ T6123] veth1_vlan: entered allmulticast mode
[   72.533830][ T6123] veth0_vlan: entered allmulticast mode
[   72.570608][ T6123] vlan0: entered allmulticast mode
[   72.576585][ T6123] vlan1: entered allmulticast mode
[   72.586936][ T6123] macvlan0: entered allmulticast mode
[   72.596245][ T6123] macvlan1: entered allmulticast mode
[   72.601772][ T6123] ipvlan0: entered allmulticast mode
[   72.604948][ T6123] ipvlan1: entered allmulticast mode
[   72.610784][ T6123] veth1_macvtap: entered allmulticast mode
[   72.617007][ T6123] veth0_macvtap: entered allmulticast mode
[   72.626364][ T6123] macvtap0: entered allmulticast mode
[   72.641331][ T6123] macsec0: entered allmulticast mode
[   72.660466][ T6123] geneve0: entered allmulticast mode
[   72.671211][ T6123] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[   72.677218][ T6123] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[   72.680832][ T6123] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[   72.693982][ T6123] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[   72.703792][ T6123] geneve1: entered allmulticast mode
[   72.734711][ T6123] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode
[   72.748125][ T6123] mac80211_hwsim hwsim5 wlan1: entered allmulticast mode
[   72.756631][ T6123] netdevsim netdevsim0 eth0: entered allmulticast mode
[   72.759715][ T6123] netdevsim netdevsim0 eth1: entered allmulticast mode
[   72.767806][ T6123] netdevsim netdevsim0 eth2: entered allmulticast mode
[   72.770859][ T6123] netdevsim netdevsim0 eth3: entered allmulticast mode
[   72.774230][ T6123] syzkaller0: entered allmulticast mode
[   72.894286][ T6136] team0 (unregistering): Port device team_slave_0 removed
[   72.905865][ T6136] team0 (unregistering): Port device team_slave_1 removed
[   72.959664][ T6138] bond0: (slave wlan1): Enslaving as an active interface with an up link
[   73.195730][ T6156] nbd0: detected capacity change from 0 to 127
[   73.209556][   T57] block nbd0: Receive control failed (result -32)
[   73.214806][ T5835] block nbd0: Dead connection, failed to find a fallback
[   73.217749][ T5835] block nbd0: shutting down sockets
[   73.220078][ T5835] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   73.240082][ T5835] Buffer I/O error on dev nbd0, logical block 0, async page read
[   73.255978][ T5835] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   73.259618][ T5835] Buffer I/O error on dev nbd0, logical block 1, async page read
[   73.285985][ T5835] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   73.289606][ T5835] Buffer I/O error on dev nbd0, logical block 2, async page read
[   73.314547][ T5835] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   73.318015][ T5835] Buffer I/O error on dev nbd0, logical block 3, async page read
[   73.321197][ T5835] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   73.342241][ T5835] Buffer I/O error on dev nbd0, logical block 0, async page read
[   73.345857][ T5835] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   73.351194][ T5835] Buffer I/O error on dev nbd0, logical block 1, async page read
[   73.363595][ T5835] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   73.367016][ T5835] Buffer I/O error on dev nbd0, logical block 2, async page read
[   73.370079][ T5835] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   73.375353][ T5835] Buffer I/O error on dev nbd0, logical block 3, async page read
[   73.378392][ T5835] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   73.382174][ T5835] Buffer I/O error on dev nbd0, logical block 0, async page read
[   73.385386][ T5835] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   73.389055][ T5835] Buffer I/O error on dev nbd0, logical block 1, async page read
[   73.399513][ T5835] ldm_validate_partition_table(): Disk read failed.
[   73.418509][ T5835] Dev nbd0: unable to read RDB block 0
[   73.433960][ T5835]  nbd0: unable to read partition table
[   73.447700][ T5835] ldm_validate_partition_table(): Disk read failed.
[   73.468341][ T5835] Dev nbd0: unable to read RDB block 0
[   73.474059][ T5835]  nbd0: unable to read partition table
[   73.521662][ T6181] macvlan2: entered allmulticast mode
[   73.528162][ T6181] netdevsim netdevsim2 netdevsim0: entered promiscuous mode
[   73.533647][ T6181] netdevsim netdevsim2 netdevsim0: entered allmulticast mode
[   73.540870][ T6181] team0: Port device macvlan2 added
[   73.556889][ T6185] netlink: 24 bytes leftover after parsing attributes in process `syz.1.117'.
[   73.559689][ T6185] netlink: 'syz.1.117': attribute type 1 has an invalid length.
[   73.582507][ T6185] netlink: 32 bytes leftover after parsing attributes in process `syz.1.117'.
[   73.752141][ T5845] Bluetooth: hci2: command tx timeout
[   74.104122][ T6227] netlink: 36 bytes leftover after parsing attributes in process `syz.1.133'.
[   74.290019][ T6239] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes.
[   74.410209][ T6251] block nbd0: NBD_DISCONNECT
[   74.414346][ T6251] block nbd0: Send disconnect failed -32
[   74.525695][ T6257] (unnamed net_device) (uninitialized): up delay (1024) is not a multiple of miimon (100), value rounded to 1000 ms
[   74.530019][ T6257] (unnamed net_device) (uninitialized): down delay (4) is not a multiple of miimon (100), value rounded to 0 ms
[   74.536117][ T6259] netlink: 'syz.0.147': attribute type 1 has an invalid length.
[   74.708072][ T6270] netlink: 'syz.2.151': attribute type 3 has an invalid length.
[   74.712385][ T6270] netlink: 224 bytes leftover after parsing attributes in process `syz.2.151'.
[   74.903496][ T6285] netlink: 12 bytes leftover after parsing attributes in process `syz.2.159'.
[   74.927297][ T6285] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms)
[   74.989969][ T6291] IPv6: Can't replace route, no match found
[   74.995412][ T6295] netlink: 8 bytes leftover after parsing attributes in process `syz.1.164'.
[   75.041491][ T6299] tipc: Started in network mode
[   75.044296][ T6299] tipc: Node identity ac14142a, cluster identity 4711
[   75.047829][ T6299] tipc: Enabled bearer <udp:syz2>, priority 10
[   75.190534][ T6311] netlink: 'syz.0.171': attribute type 1 has an invalid length.
[   75.201376][ T6311] netlink: 'syz.0.171': attribute type 2 has an invalid length.
[   75.206277][ T6311] netlink: 1172 bytes leftover after parsing attributes in process `syz.0.171'.
[   75.307822][ T6321] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   75.546682][ T5901] IPVS: starting estimator thread 0...
[   75.615636][ T6352] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[   75.632102][ T6345] IPVS: using max 62 ests per chain, 148800 per kthread
[   76.187021][ T5901] tipc: Node number set to 2886997034
[   76.904110][ T6424] __nla_validate_parse: 4 callbacks suppressed
[   76.904122][ T6424] netlink: 24 bytes leftover after parsing attributes in process `syz.1.217'.
[   77.299918][ T6454] netlink: 'syz.2.229': attribute type 1 has an invalid length.
[   77.305812][ T6454] netlink: 180 bytes leftover after parsing attributes in process `syz.2.229'.
[   77.443394][ T6464] netlink: 'syz.1.234': attribute type 10 has an invalid length.
[   77.450399][ T6464] bridge0: port 2(bridge_slave_1) entered disabled state
[   77.453737][ T6464] bridge_slave_1: left allmulticast mode
[   77.455474][ T6464] bridge_slave_1: left promiscuous mode
[   77.457298][ T6464] bridge0: port 2(bridge_slave_1) entered disabled state
[   77.465403][ T6464] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link
[   77.515908][ T6470] netem: incorrect ge model size
[   77.517686][ T6470] netem: change failed
[   78.085116][ T6503] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT
[   78.107177][ T6506] netlink: 72 bytes leftover after parsing attributes in process `syz.2.253'.
[   78.111963][ T6506] netlink: 72 bytes leftover after parsing attributes in process `syz.2.253'.
[   78.208556][ T6518] Zero length message leads to an empty skb
[   78.237923][ T6521] netlink: 8 bytes leftover after parsing attributes in process `syz.0.260'.
[   78.826273][ T6560] bond0: (slave bridge_slave_1): Releasing backup interface
[   78.836446][ T6560] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check.
[   79.251646][ T6583] netlink: 'syz.1.289': attribute type 21 has an invalid length.
[   79.258172][ T6583] netlink: 128 bytes leftover after parsing attributes in process `syz.1.289'.
[   79.261494][ T6583] netlink: 3 bytes leftover after parsing attributes in process `syz.1.289'.
[   79.334988][ T6593] netlink: 8 bytes leftover after parsing attributes in process `syz.0.292'.
[   79.349381][ T6595] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING
[   79.434898][   T24] hid-generic 0005:15C2:0007.0001: collection stack underflow
[   79.437393][   T24] hid-generic 0005:15C2:0007.0001: item 0 0 0 12 parsing failed
[   79.440086][   T24] hid-generic 0005:15C2:0007.0001: probe with driver hid-generic failed with error -22
[   79.483553][ T6605] netlink: 8 bytes leftover after parsing attributes in process `syz.2.297'.
[   79.630898][ T6618] netlink: 20 bytes leftover after parsing attributes in process `syz.1.304'.
[   79.636076][ T5954] bond0: (slave wlan1): link status definitely down, disabling slave
[   79.641058][ T6619] netlink: 'syz.2.303': attribute type 4 has an invalid length.
[   79.688008][ T6622] netlink: 'syz.1.305': attribute type 4 has an invalid length.
[   79.704323][ T6622] netlink: 'syz.1.305': attribute type 4 has an invalid length.
[   80.417298][ T5866] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   80.508423][ T5866] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   80.575148][ T5866] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   80.655094][ T5866] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   80.840629][ T5866] bridge_slave_0: left allmulticast mode
[   80.843027][ T5866] bridge_slave_0: left promiscuous mode
[   80.845912][ T5866] bridge0: port 1(bridge_slave_0) entered disabled state
[   80.857978][ T5834] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   80.864357][ T5834] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   80.867760][ T5834] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   80.871770][ T5834] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   80.876159][ T5834] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   81.275224][ T5866] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   81.287177][ T5866] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   81.302791][ T5866] bond0 (unregistering): (slave wlan1): Releasing backup interface
[   81.328293][ T5866] bond0 (unregistering): Released all slaves
[   81.341728][ T5866] bond1 (unregistering): Released all slaves
[   81.353916][ T5866] bond2 (unregistering): Released all slaves
[   81.371598][ T5866] bond3 (unregistering): Released all slaves
[   82.076957][ T6723] syzkaller1: entered promiscuous mode
[   82.080205][ T6723] syzkaller1: entered allmulticast mode
[   82.258675][ T5866] hsr_slave_0: left promiscuous mode
[   82.263786][ T5866] hsr_slave_1: left promiscuous mode
[   82.265944][ T5866] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   82.268292][ T5866] batman_adv: batadv0: Removing interface: batadv_slave_0
[   82.271741][ T5866] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   82.278073][ T5866] batman_adv: batadv0: Removing interface: batadv_slave_1
[   82.291630][ T5866] veth1_macvtap: left promiscuous mode
[   82.294460][ T5866] veth0_macvtap: left promiscuous mode
[   82.296356][ T5866] veth1_vlan: left promiscuous mode
[   82.298049][ T5866] veth0_vlan: left promiscuous mode
[   82.411440][   T81] smc: removing ib device syz0
[   82.793930][ T6738] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode
[   82.849603][ T5901] ==================================================================
[   82.852150][ T5901] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x6e/0x190
[   82.854800][ T5901] Read of size 8 at addr ffff88802e2f22e8 by task kworker/0:5/5901
[   82.857750][ T5901] 
[   82.858803][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: kworker/0:5 Not tainted 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 PREEMPT(full) 
[   82.858815][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   82.858842][ T5901] Workqueue: events smc_ib_port_event_work
[   82.858860][ T5901] Call Trace:
[   82.858865][ T5901]  <TASK>
[   82.858870][ T5901]  dump_stack_lvl+0x189/0x250
[   82.858883][ T5901]  ? __virt_addr_valid+0x1c8/0x5c0
[   82.858894][ T5901]  ? rcu_is_watching+0x15/0xb0
[   82.858904][ T5901]  ? __pfx_dump_stack_lvl+0x10/0x10
[   82.858913][ T5901]  ? rcu_is_watching+0x15/0xb0
[   82.858921][ T5901]  ? lock_release+0x4b/0x3e0
[   82.858931][ T5901]  ? __virt_addr_valid+0x1c8/0x5c0
[   82.858940][ T5901]  ? __virt_addr_valid+0x4a5/0x5c0
[   82.858949][ T5901]  print_report+0xd2/0x2b0
[   82.858957][ T5901]  ? __ethtool_get_link_ksettings+0x6e/0x190
[   82.858969][ T5901]  kasan_report+0x118/0x150
[   82.858981][ T5901]  ? __ethtool_get_link_ksettings+0x6e/0x190
[   82.858992][ T5901]  __ethtool_get_link_ksettings+0x6e/0x190
[   82.859004][ T5901]  ib_get_eth_speed+0x15e/0x7b0
[   82.859016][ T5901]  ? __pfx_ib_get_eth_speed+0x10/0x10
[   82.859028][ T5901]  ? do_raw_spin_unlock+0x4d/0x240
[   82.859041][ T5901]  rxe_query_port+0x93/0x3b0
[   82.859052][ T5901]  ib_query_port+0x170/0x830
[   82.859065][ T5901]  smc_ib_port_event_work+0x15a/0x940
[   82.859078][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[   82.859090][ T5901]  ? process_scheduled_works+0x9ef/0x17b0
[   82.859099][ T5901]  ? process_scheduled_works+0x9ef/0x17b0
[   82.859108][ T5901]  process_scheduled_works+0xae1/0x17b0
[   82.859122][ T5901]  ? __pfx_process_scheduled_works+0x10/0x10
[   82.859133][ T5901]  worker_thread+0x8a0/0xda0
[   82.859142][ T5901]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   82.859154][ T5901]  ? __kthread_parkme+0x7b/0x200
[   82.859166][ T5901]  kthread+0x711/0x8a0
[   82.859176][ T5901]  ? __pfx_worker_thread+0x10/0x10
[   82.859185][ T5901]  ? __pfx_kthread+0x10/0x10
[   82.859194][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[   82.859204][ T5901]  ? lockdep_hardirqs_on+0x9c/0x150
[   82.859216][ T5901]  ? __pfx_kthread+0x10/0x10
[   82.859225][ T5901]  ret_from_fork+0x3fc/0x770
[   82.859235][ T5901]  ? __pfx_ret_from_fork+0x10/0x10
[   82.859244][ T5901]  ? __switch_to_asm+0x39/0x70
[   82.859253][ T5901]  ? __switch_to_asm+0x33/0x70
[   82.859262][ T5901]  ? __pfx_kthread+0x10/0x10
[   82.859271][ T5901]  ret_from_fork_asm+0x1a/0x30
[   82.859284][ T5901]  </TASK>
[   82.859287][ T5901] 
[   82.932340][ T5901] Allocated by task 5832:
[   82.933621][ T5901]  kasan_save_track+0x3e/0x80
[   82.935082][ T5901]  __kasan_kmalloc+0x93/0xb0
[   82.936438][ T5901]  __kvmalloc_node_noprof+0x30d/0x5f0
[   82.938054][ T5901]  alloc_netdev_mqs+0xa6/0x11e0
[   82.939548][ T5901]  rtnl_create_link+0x31f/0xd10
[   82.941003][ T5901]  rtnl_newlink_create+0x25c/0xb00
[   82.942515][ T5901]  rtnl_newlink+0x16d6/0x1c70
[   82.943963][ T5901]  rtnetlink_rcv_msg+0x7cf/0xb70
[   82.945692][ T5901]  netlink_rcv_skb+0x208/0x470
[   82.947455][ T5901]  netlink_unicast+0x75c/0x8e0
[   82.949147][ T5901]  netlink_sendmsg+0x805/0xb30
[   82.950650][ T5901]  __sock_sendmsg+0x21c/0x270
[   82.952080][ T5901]  __sys_sendto+0x3bd/0x520
[   82.953437][ T5901]  __x64_sys_sendto+0xde/0x100
[   82.954917][ T5901]  do_syscall_64+0xfa/0x3b0
[   82.956246][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   82.958053][ T5901] 
[   82.958791][ T5901] Freed by task 5866:
[   82.960010][ T5901]  kasan_save_track+0x3e/0x80
[   82.961429][ T5901]  kasan_save_free_info+0x46/0x50
[   82.962976][ T5901]  __kasan_slab_free+0x62/0x70
[   82.964459][ T5901]  kfree+0x18e/0x440
[   82.965667][ T5901]  device_release+0x9c/0x1c0
[   82.967055][ T5901]  kobject_put+0x22b/0x480
[   82.968420][ T5901]  netdev_run_todo+0xd2e/0xea0
[   82.969922][ T5901]  default_device_exit_batch+0x81e/0x890
[   82.971569][ T5901]  ops_undo_list+0x525/0x990
[   82.972941][ T5901]  cleanup_net+0x4c5/0x800
[   82.974260][ T5901]  process_scheduled_works+0xae1/0x17b0
[   82.975911][ T5901]  worker_thread+0x8a0/0xda0
[   82.977321][ T5901]  kthread+0x711/0x8a0
[   82.978576][ T5901]  ret_from_fork+0x3fc/0x770
[   82.980007][ T5901]  ret_from_fork_asm+0x1a/0x30
[   82.981475][ T5901] 
[   82.982226][ T5901] The buggy address belongs to the object at ffff88802e2f2000
[   82.982226][ T5901]  which belongs to the cache kmalloc-cg-4k of size 4096
[   82.986526][ T5901] The buggy address is located 744 bytes inside of
[   82.986526][ T5901]  freed 4096-byte region [ffff88802e2f2000, ffff88802e2f3000)
[   82.990732][ T5901] 
[   82.991473][ T5901] The buggy address belongs to the physical page:
[   82.993388][ T5901] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2e2f0
[   82.995998][ T5901] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   82.998490][ T5901] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[   83.000705][ T5901] page_type: f5(slab)
[   83.001919][ T5901] raw: 00fff00000000040 ffff88801a44b500 dead000000000122 0000000000000000
[   83.004463][ T5901] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[   83.007070][ T5901] head: 00fff00000000040 ffff88801a44b500 dead000000000122 0000000000000000
[   83.009639][ T5901] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[   83.012211][ T5901] head: 00fff00000000003 ffffea0000b8bc01 00000000ffffffff 00000000ffffffff
[   83.014880][ T5901] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   83.017460][ T5901] page dumped because: kasan: bad access detected
[   83.019403][ T5901] page_owner tracks the page as allocated
[   83.021120][ T5901] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5841, tgid 5841 (syz-executor), ts 64633208782, free_ts 0
[   83.027116][ T5901]  post_alloc_hook+0x240/0x2a0
[   83.028579][ T5901]  get_page_from_freelist+0x21e4/0x22c0
[   83.030234][ T5901]  __alloc_frozen_pages_noprof+0x181/0x370
[   83.031993][ T5901]  alloc_pages_mpol+0x232/0x4a0
[   83.033496][ T5901]  allocate_slab+0x8a/0x3b0
[   83.034874][ T5901]  ___slab_alloc+0xbfc/0x1480
[   83.036280][ T5901]  __kmalloc_noprof+0x305/0x4f0
[   83.037736][ T5901]  __register_sysctl_table+0x72/0x1340
[   83.039362][ T5901]  __addrconf_sysctl_register+0x398/0x530
[   83.041064][ T5901]  addrconf_sysctl_register+0x168/0x1c0
[   83.042665][ T5901]  ipv6_add_dev+0xd46/0x1370
[   83.044401][ T5901]  addrconf_notify+0x794/0x1010
[   83.045962][ T5901]  notifier_call_chain+0x1b6/0x3e0
[   83.047538][ T5901]  register_netdevice+0x1608/0x1ae0
[   83.049239][ T5901]  macvlan_common_newlink+0x120a/0x1980
[   83.050928][ T5901]  rtnl_newlink_create+0x310/0xb00
[   83.052464][ T5901] page_owner free stack trace missing
[   83.054114][ T5901] 
[   83.054940][ T5901] Memory state around the buggy address:
[   83.056616][ T5901]  ffff88802e2f2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   83.059110][ T5901]  ffff88802e2f2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   83.061544][ T5901] >ffff88802e2f2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   83.063996][ T5901]                                                           ^
[   83.066219][ T5901]  ffff88802e2f2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   83.068655][ T5901]  ffff88802e2f2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   83.071007][ T5901] ==================================================================
[   83.073970][ T5834] Bluetooth: hci0: command tx timeout
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   83.083952][ T5901] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   83.086310][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: kworker/0:5 Not tainted 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 PREEMPT(full) 
[   83.090005][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   83.093162][ T5901] Workqueue: events smc_ib_port_event_work
[   83.094986][ T5901] Call Trace:
[   83.096033][ T5901]  <TASK>
[   83.096965][ T5901]  dump_stack_lvl+0x99/0x250
[   83.098401][ T5901]  ? __asan_memcpy+0x40/0x70
[   83.099832][ T5901]  ? __pfx_dump_stack_lvl+0x10/0x10
[   83.101390][ T5901]  ? __pfx__printk+0x10/0x10
[   83.102776][ T5901]  panic+0x2db/0x790
[   83.104007][ T5901]  ? __pfx_panic+0x10/0x10
[   83.105361][ T5901]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[   83.107141][ T5901]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   83.109046][ T5901]  ? print_memory_metadata+0x314/0x400
[   83.110674][ T5901]  ? __ethtool_get_link_ksettings+0x6e/0x190
[   83.112482][ T5901]  check_panic_on_warn+0x89/0xb0
[   83.113971][ T5901]  ? __ethtool_get_link_ksettings+0x6e/0x190
[   83.115735][ T5901]  end_report+0x78/0x160
[   83.117000][ T5901]  kasan_report+0x129/0x150
[   83.118353][ T5901]  ? __ethtool_get_link_ksettings+0x6e/0x190
[   83.120117][ T5901]  __ethtool_get_link_ksettings+0x6e/0x190
[   83.121905][ T5901]  ib_get_eth_speed+0x15e/0x7b0
[   83.123367][ T5901]  ? __pfx_ib_get_eth_speed+0x10/0x10
[   83.124958][ T5901]  ? do_raw_spin_unlock+0x4d/0x240
[   83.126479][ T5901]  rxe_query_port+0x93/0x3b0
[   83.127864][ T5901]  ib_query_port+0x170/0x830
[   83.129284][ T5901]  smc_ib_port_event_work+0x15a/0x940
[   83.130880][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[   83.132421][ T5901]  ? process_scheduled_works+0x9ef/0x17b0
[   83.134121][ T5901]  ? process_scheduled_works+0x9ef/0x17b0
[   83.135825][ T5901]  process_scheduled_works+0xae1/0x17b0
[   83.137484][ T5901]  ? __pfx_process_scheduled_works+0x10/0x10
[   83.139268][ T5901]  worker_thread+0x8a0/0xda0
[   83.140614][ T5901]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   83.142552][ T5901]  ? __kthread_parkme+0x7b/0x200
[   83.144095][ T5901]  kthread+0x711/0x8a0
[   83.145306][ T5901]  ? __pfx_worker_thread+0x10/0x10
[   83.146847][ T5901]  ? __pfx_kthread+0x10/0x10
[   83.148275][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[   83.149847][ T5901]  ? lockdep_hardirqs_on+0x9c/0x150
[   83.151410][ T5901]  ? __pfx_kthread+0x10/0x10
[   83.152825][ T5901]  ret_from_fork+0x3fc/0x770
[   83.154250][ T5901]  ? __pfx_ret_from_fork+0x10/0x10
[   83.155820][ T5901]  ? __switch_to_asm+0x39/0x70
[   83.157257][ T5901]  ? __switch_to_asm+0x33/0x70
[   83.158696][ T5901]  ? __pfx_kthread+0x10/0x10
[   83.160124][ T5901]  ret_from_fork_asm+0x1a/0x30
[   83.161571][ T5901]  </TASK>
[   83.163129][ T5901] Kernel Offset: disabled
[   83.164419][ T5901] Rebooting in 86400 seconds..

VM DIAGNOSIS:
20:22:38  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000061 RBX=0000000000000061 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000460f090
R8 =ffff888107b88237 R9 =1ffff11020f71046 R10=dffffc0000000000 R11=ffffffff85478780
R12=dffffc0000000000 R13=ffffffff99af98c4 R14=ffffffff99dfe6e0 R15=0000000000000000
RIP=ffffffff854787fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b30711ff8 CR3=0000000020084000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000000000000000 0000000000000000 XMM03=ffffffffffffffff ffffffffffffffff
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f4461e11c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=e94feac532ae2f00 RBX=ffffffff81976c78 RCX=e94feac532ae2f00 RDX=0000000000000001
RSI=ffffffff8d998b14 RDI=ffffffff8be29dc0 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f5b R9 =1ffff11026cc65eb R10=dffffc0000000000 R11=ffffed1026cc65ec
R12=ffffffff8fa1f3f0 R13=0000000000000001 R14=0000000000000001 R15=1ffff1102001d000
RIP=ffffffff8b6f34d3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f5ad3e5e440 CR3=00000001110f4000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=ffffffff00000000 ffff000000000000 XMM01=0000000033687465 000055b29cdc7ab8
XMM02=00010000ffffffff 0101000000000000 XMM03=00000000000000ff 0000000000000000
XMM04=0000000000000000 000000000000ff00 XMM05=1600000000000000 00000000000002ff
XMM06=1600000000000000 00000000000002ff XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
